Singularity
Singularity is a Linux kernel rootkit targeting Linux kernel 6.x systems. The provided content describes it as a modern LKM-based rootkit created by MatheuZSecurity that uses ftrace-based hooks to intercept kernel functionality, including SysRq diagnostic paths, in order to hide processes from kernel ring buffer dumps. It is explicitly described as using a load_and_persistence.sh script that ultimately loads its kernel module with insmod, and as establishing persistence by creating a configuration file under /etc/modules-load.d/. The content also notes suggested deployment from /dev/shm.
High-confidence capabilities described in the content include process hiding, file concealment, network stealth, privilege escalation to root, real-time log filtering and sanitization, blocking eBPF-based monitoring, disabling io_uring protections, preventing legitimate kernel module loading, and intercepting attempts to disable ftrace. It is also described as monitoring more than 15 sensitive syscalls related to file I/O and returning false success while blocking execution. The rootkit reportedly clears the kernel tainted_mask to reduce detection of unauthorized kernel modifications and filters forensic keywords such as taint, journal, and kallsyms_lookup_name from logs. A Kyntra blog post specifically states that Singularity intercepts SysRq diagnostic paths to hide processes from kernel ring buffer dumps.
The content further attributes remote access functionality to Singularity via an ICMP-triggered reverse shell, with child processes inheriting hiding properties. It is described as compatible with x64 and ia32 architectures and as bypassing common Linux rootkit detection tools including unhide, chkrootkit, and rkhunter. Mentioned indicators and artifacts include the use of a .ko kernel module loaded via insmod, persistence under /etc/modules-load.d/, execution from /dev/shm, and log-clearing behavior including attempts to clear logs via journalctl.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Discovery
1 technique
Discovery
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux rootkit that relies on built-in LKM-loading utilities, sets up persistence via modules-load.d, and is discussed for stealthy deployment from /dev/shm and log-clearing behavior.
Linux rootkit referenced as abusing ftrace to implement stealthy kernel function hooking.
Linux kernel module rootkit targeting Linux 6.x; hooks/intercepts Magic SysRq task dump paths (scheduler/OOM reporting) to hide activity from incident responders relying on kernel log output.
Singularity is an advanced Linux kernel rootkit (LKM) that provides attackers with stealthy, persistent, and comprehensive control over compromised systems. It hides processes, files, and network connections, escalates privileges, and evades detection by modern security tools, including EDR and forensic analysis. It leverages ftrace hooking, blocks eBPF monitoring, disables io_uring protections, and prevents legitimate kernel module loading. It also provides a remote ICMP-triggered reverse shell and aggressively sanitizes logs and kernel taint indicators.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.